Security inspections performed on network communications often consume a significant amount of resources. For example, a firewall may perform security inspections on packets entering a network. As part of such inspections, the firewall may first parse the packets and then attempt to match certain information parsed from the packets with signatures included in an Intrusion Prevention System (IPS) database. In this example, the firewall may perform the parsing and the matching with a Central Processing Unit (CPU) and/or a Graphics Processing Unit (GPU). In the event that information parsed from one of the packets matches a signature that represents a known attack pattern, the firewall may classify the packet as malicious and then take some sort of remedial action.
Unfortunately, since traditional IPS parsing and matching operations are performed by the CPU and/or GPU, these operations may slow down the CPU and/or GPU relative to the packet Input/Output (I/O) rate and/or line rate, thereby impairing the firewall's performance. Moreover, since traditional IPS security inspections call for packets to be parsed before being matched, the firewall may end up parsing packets that ultimately result in no match, thereby decreasing the efficiency of the IPS security inspections.
The instant disclosure, therefore, identifies and addresses a need for systems and methods for accelerating security inspections using inline pattern matching.